# Permisos para el workflow "Uptime Kuma -> K8s Auto-Restart" (2026-07-30).
#
# El nodo Code lee el token proyectado de la ServiceAccount y hace un PATCH
# contra kubernetes.default.svc. Nunca habia existido ningun Role ni RoleBinding
# para n8n: el API devolvia 403 y el workflow se iba por la rama de "reinicio
# fallido". Los 23 "exitos" de workflow_statistics eran eso -- el aviso de fallo
# enviandose bien. La integracion jamas reinicio nada.
#
# SA propia y no la "default" del namespace: cualquier pod que se despliegue en
# n8n sin pedir SA hereda la default, y estos permisos cruzan namespaces.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: n8n-restarter
  namespace: n8n
---
# get ademas de patch: tras el PATCH el workflow espera 60 s y RELEE el
# deployment para comprobar readyReplicas -- sin get, ese chequeo posterior
# devolvia "Cannot read properties of undefined (reading 'replicas')".
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: n8n-restarter
rules:
  - apiGroups: ["apps"]
    # statefulsets porque Gitea lo es (no un Deployment) y esta en el mapa.
    resources: ["deployments", "statefulsets"]
    verbs: ["get", "patch"]
---
# Un RoleBinding por namespace y no un ClusterRoleBinding: el webhook que
# dispara esto es PUBLICO y sin autenticar, asi que el alcance de lo que
# puede reiniciar un desconocido debe ser exactamente el SERVICE_MAP.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: n8n
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: monitoring
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: homarr
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: gitea
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: authentik
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: vaultwarden
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: ollama
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
# argocd el ultimo a proposito: reiniciar argocd-server o argocd-repo-server
# es lo mas agresivo del mapa (deja el cluster sin reconciliar un rato).
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: argocd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n